4 ms·

Bug bounty programs help when you want to gradually improve the quality of your system, but no single bug can be used to blackmail or halt your entire business.

by slver 5y ago

Bug bounty programs help when you want to gradually improve the quality of your system, but no single bug can be used to blackmail or halt your entire business. You see, your proposal's math doesn't work. Acme has a system worth 100 million. This means a blackmailer can ask for 100 million if they find one bug (let's keep things simple). Obviously Acme can't offer 100 million in a bug bounty program for every bug found. So let's say they offer 100k, they're very generous. This means after 1000 bugs found, they've transferred their entire worth to bug bounty hunters. So while Acme had to create a system worth 100 million, they own 0 of it now. They gave everything to bounty hunters. Is this fair? No. What happened is that instead of one blackmailer, there were 1000 blackmailers saying "we're the good guys, we help you find bugs in your system, OR ELSE". When a health industry keeps raising the prices on you, because they keep saying "we're the good guys, we help you not die of cancer, give us your house, OR ELSE" we love them right? But that's not the end of the story. Did the good guys who took all your money found all the bugs? Well a blackmailer still stands to gain 1000x more than anyone on the bug bounty program, if they can find a bug before the bug bounty hunters have leeched the host dry of their last drop of blood. So a malicious hacker is motivated to be faster, and financed to be better, with more people, better equipment, and so on. So the bug bounty program is absolutely inadequate solution to the problem. Paying more to match what a blackmailer would ask, turns the bug bounty hunters into blackmailers. Except they also can't guarantee shit. And they can't cover losses for shit if they miss something either. They just take your money and leave you almost as vulnerable as you were. So, no. Companies won't have bigger bug bounty programs. Instead they'll do something that might help. Like move off the internet, making things more inconvenient for everyone, and insure heavily anything they put online.

vmception 5y ago
Great points My primary rebuttal is that enough hackers don't want 1000x more than anyone else in the bug bounty program, they don't want the liability associated with reintegrating that money back into society Somewhere in between bug bounties pricing and payouts now, and the incentive to cripple/steal everything for ransom, is the more accurate medium
- slver 5y ago
  The problem with your rebuttal is that there is ZERO liability in asking Bitcoin to be moved into an anonymous wallet. And when you include the whole world into your scenario, you need to realize there are a whole lot of countries that can't give a flying fuck about America, or Japan, or basically any other country than theirs, especially when for example the target country is dropping bombs on their heads, or crippling their economy with sanctions. You think we're all good guys and we'll get along, see? But actually, Bitcoin has enabled a new type of international warfare. And thinking positive thoughts will do nothing to prevent that.
  - vmception 5y ago
    I can make the same observations as you, the difference is that this doesn't bother me. The concept will never go away. The concept of computing a hash client side under an agreed upon set of conformity for eventually addition to a globally stored list of hashes. Although you haven't argued for making it go away, people that talk like you typically are arguing for the idea that the state can successfully make it go away. This concept works whether institutional exchanges say each hash is part of a unit worth $60,000 a pop or those institutions don't exist and the market says the units are worth $2 a pop.
    - slver 5y ago
      The concept of deciding something that's rare is valuable will never go away. It's just revision #987192 of the "tulip craze" phenomenon. But this will keep getting worse and worse until cryptocurrencies are outlawed. And this will not stop their use completely, but their value hinges on their trade value, which in large part depends on their legality. So the value will collapse to nothing. So now blockchains have no incentive to exist either. Poof.
      - vmception 5y ago
        > Although you haven't argued for making it go away, people that talk like you typically are arguing for the idea that the state can successfully make it go away. and there it is.

by slver 5y ago

vmception 5y ago

Great points My primary rebuttal is that enough hackers don't want 1000x more than anyone else in the bug bounty program, they don't want the liability associated with reintegrating that money back into society Somewhere in between bug bounties pricing and payouts now, and the incentive to cripple/steal everything for ransom, is the more accurate medium

slver 5y ago
The problem with your rebuttal is that there is ZERO liability in asking Bitcoin to be moved into an anonymous wallet. And when you include the whole world into your scenario, you need to realize there are a whole lot of countries that can't give a flying fuck about America, or Japan, or basically any other country than theirs, especially when for example the target country is dropping bombs on their heads, or crippling their economy with sanctions. You think we're all good guys and we'll get along, see? But actually, Bitcoin has enabled a new type of international warfare. And thinking positive thoughts will do nothing to prevent that.
- vmception 5y ago
  I can make the same observations as you, the difference is that this doesn't bother me. The concept will never go away. The concept of computing a hash client side under an agreed upon set of conformity for eventually addition to a globally stored list of hashes. Although you haven't argued for making it go away, people that talk like you typically are arguing for the idea that the state can successfully make it go away. This concept works whether institutional exchanges say each hash is part of a unit worth $60,000 a pop or those institutions don't exist and the market says the units are worth $2 a pop.
  - slver 5y ago
    The concept of deciding something that's rare is valuable will never go away. It's just revision #987192 of the "tulip craze" phenomenon. But this will keep getting worse and worse until cryptocurrencies are outlawed. And this will not stop their use completely, but their value hinges on their trade value, which in large part depends on their legality. So the value will collapse to nothing. So now blockchains have no incentive to exist either. Poof.
    - vmception 5y ago
      > Although you haven't argued for making it go away, people that talk like you typically are arguing for the idea that the state can successfully make it go away. and there it is.